Home/ Questions/Q 8876927
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-14T19:20:17+00:00

When I create a packet filter (eg for only tcp traffic) with tcpdump -dd

  • 0

When I create a packet filter (eg for only tcp traffic) with

tcpdump -dd tcp

the packet filter output is

{ 0x28, 0, 0, 0x0000000c },
{ 0x15, 0, 2, 0x000086dd },
{ 0x30, 0, 0, 0x00000014 },
{ 0x15, 3, 4, 0x00000006 },
{ 0x15, 0, 3, 0x00000800 },
{ 0x30, 0, 0, 0x00000017 },
{ 0x15, 0, 1, 0x00000006 },
{ 0x6, 0, 0, 0x0000ffff },
{ 0x6, 0, 0, 0x00000000 },

But when I do the same programatically;

pcap_compile_nopcap(1500, DLT_EN10MB, &fcode, "tcp", 1, 0);
struct bpf_insn *insn = fcode.bf_insns;

for (i = 0; i < fcode.bf_len; ++insn, ++i)
{
  printf("{ 0x%x, %d, %d, 0x%08x },\n",
     insn->code, insn->jt, insn->jf, insn->k);
}

I get the following packet filter output:

{ 0x28, 0, 0, 0x0000000c },
{ 0x15, 0, 5, 0x000086dd },
{ 0x30, 0, 0, 0x00000014 },
{ 0x15, 6, 0, 0x00000006 },
{ 0x15, 0, 6, 0x0000002c },
{ 0x30, 0, 0, 0x00000036 },
{ 0x15, 3, 4, 0x00000006 },
{ 0x15, 0, 3, 0x00000800 },
{ 0x30, 0, 0, 0x00000017 },
{ 0x15, 0, 1, 0x00000006 },
{ 0x6, 0, 0, 0x000005dc },
{ 0x6, 0, 0, 0x00000000 },

Why are the two packet filters different?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Probably because the tcpdump on your system is built with an older version of libpcap than your program. The tcpdump on your system is probably using a libpcap without this change:

    commit 58275c05a5cf9c3512bcbb1192ff351d32ccccbd
Author: Guy Harris <guy@alum.mit.edu>
Date:   Thu Sep 1 22:21:45 2011 -0700

    Handle some amount of IPv6 fragmentation.

    If we're checking for a particular protocol running on top of IPv6, and
    we're not doing full protocol-chain chasing for all "running on top of
    IPv6" tests, at least check for a fragmentation header before the header
    for the protocol.

    and your program is probably using a libpcap with that change. That change went into libpcap somewhere in the libpcap 1.3.x timeframe.

    • 0